T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:739- Finding
Privacy Constraint Override and Excessive Session Context Collection
- Content
View full analysis
- Remediation
View remediation
Security audit
nutcracker
Security checks for vulnerabilities and agentic risk
Overview
This skill is a local UX research observer, but it collects and preserves far more sensitive session context than its purpose needs and its implemented redaction does not match its privacy claims.
Review this carefully before installing. It does not show autonomous exfiltration or hidden remote code, but it is designed to build detailed local dossiers of conversations and tasks, including replay logs and potentially file contents, memories, identity context, environment details, and verbatim survey responses. Do not use it around secrets, proprietary work, regulated data, or private personal context unless the collection scope is narrowed and real redaction, retention limits, export review, and deletion controls are added.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/log_observation.py:74- Finding
PII Detection Is Mistaken for Redaction, Causing Plaintext Sensitive Data Storage
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:312- Finding
Unrestricted Environment Variable Access for Cost Tracking
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:983- Finding
Sensitive Replay Archive Is Included in Generic Report-Sharing Workflow
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (21)
Ssd 3
Critical
- Category
- Not specified by scanner
- Confidence
- 100% confidence
- Finding
The Super Summary Miner demands comprehensive case studies with literal replay logs, context snapshots, memories, environment details, and full file contents where feasible. This is an extreme expansion of data exposure because it can consolidate sensitive conversation data, local artifacts, credentials, proprietary code, and inferred personal context into shareable archives, creating a high-value disclosure target.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Triggering on every conversation and after every completed task creates pervasive background monitoring with little practical friction, making overcollection the default behavior. In a conversational system, that breadth substantially increases the chance of capturing sensitive, unrelated, or unexpected user content.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The instructions establish a mechanism for persistent accumulation of rich user dossiers, including structured logs of interactions, quotes, redaction metadata, and later reports and archives. This is dangerous because the research framing normalizes broad retention of behavioral and contextual data that can later be exposed, misused, or overshared.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Directing sub-agents to read the full exchange and log the user's exact words for every notable statement materially broadens the persistence of conversational content. Exact-quote retention increases the chance that secrets, proprietary requests, regulated data, or uniquely identifying phrasing are stored even when nominally redacted.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The Super Summary design expands data collection far beyond normal UX telemetry by directing export of replay logs, full file contents, environment details, memories, and identity-related context. Even if stored locally, this creates a highly sensitive dossier that can expose secrets, proprietary data, and private user context unrelated to the stated purpose of experience research.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Instructions to export 'soul state,' active memories, and identity-profile information request deeply sensitive personal context with no legitimate need for routine UX research. This data can reveal personality traits, emotional state, life circumstances, and other intimate attributes that materially increase privacy and profiling risk.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The report generator directly embeds verbatim quotes and free-text survey responses into a persisted Markdown report without performing any redaction or sanitization at report time. In a skill designed to observe every conversation and collect retrospective user feedback, this creates a high likelihood that sensitive content or missed PII redaction will be reproduced into a durable, human-shareable artifact, undermining the stated privacy model.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
This is a true vulnerability. The code only detects possible PII via regexes and stores the detection result in
pii_redacted, but it never actually redactsuser_request_verbatim, survey responses, notes, or verbatim quotes before writing them to JSONL. In this skill’s context—continuous background observation and post-task surveys on every conversation—that means sensitive user content can be persistently logged locally in cleartext, creating a significant privacy and data exposure risk if the host is accessed, backups are synced, or reports are later reviewed or shared.- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 85% confidence
- Finding
The skill clearly performs file reads and writes to persistent local storage but does not declare any explicit tool scope or allowed-tools boundary. That mismatch increases the risk of overbroad filesystem access and makes it harder for the platform or user to constrain what the skill can touch.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The top-level description understates the extent of local persistence by not clearly warning that the skill will create detailed logs, case studies, archives, and replay artifacts. That omission undermines informed consent because users may install it believing it performs lightweight analytics rather than extensive dossier building.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill promises comprehensive pre-storage redaction, but later instructions require capturing broad contextual data such as full replay logs and full file contents that are unlikely to be reliably sanitized by pattern-based PII redaction alone. This creates a misleading privacy guarantee and a realistic path to storing sensitive content that is not strictly PII, such as secrets, proprietary code, or confidential business context.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 82% confidence
- Finding
This line confirms deliberate persistence of transformed conversation content to session logs. Persistence itself is not always unsafe, but in this skill's context of pervasive monitoring and extensive dossier creation, storing redacted verbatims still increases privacy and retention risk.
- Content
md **Redaction principles:** - **Summarize, don't omit.** The replacement token tells you WHAT was discussed without exposing WHO or WHAT specifically. This preserves analytical value. - **Redact before storage.** PII never touches the JSONL logs or report files. The redaction happens in-memory before any write operation. - **Verbatim quotes get inline redaction.** A quote like *"Send this to John at john@acme.com"* becomes *"Send this to [NAME: colleague] at [EMAIL: work address]"* — the quote structure is preserved, the PII is not. - **Log redaction events.** Track what categories of PII were redacted per task in a `pii_redacted` field. This enables meta-analysis of what kinds of sensitive work users do with OpenClaw.
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 84% confidence
- Finding
Persisting task context summaries alongside survey data creates durable records of user requests and system behavior across all completed tasks. In isolation this is common analytics behavior, but here it compounds the broader surveillance pattern and can capture sensitive workflows over time.
- Content
md Every time OpenClaw completes a distinct task — a file created, a question answered, code written, a search done, a document edited — trigger this survey. Don't skip it. The point is to capture experience data while it's fresh. Before presenting the survey, write a brief **task context summary** (2-3 sentences) that describes what the user asked for and how OpenClaw responded. This summary gets stored alongside the survey responses. #### Sequential Delivery Protocol
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 93% confidence
- Finding
Creating a zip archive of case studies packages sensitive material into a portable bundle that is easier to copy, attach, or leak than individual files. Given the included replay logs and context snapshots, archiving materially amplifies disclosure risk.
- Content
md **Output:** 1. Save each case study as `~/.uxr-observer/sessions/{today}/supersummary/NNN-{slug}.md` 2. Create a `supersummary.zip` containing all case study files 3. Reference the zip in the daily report **Spawn prompt:**
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 80% confidence
- Finding
Automatic creation of a persistent directory structure on first activation establishes long-lived session storage for ongoing behavioral logging. The risk is elevated because this persistence is paired with broad triggers and extensive data capture, making silent accumulation likely.
- Content
md On first activation: 1. Create the `~/.uxr-observer/` directory structure (sessions/, reports/, today's session dir) 2. Generate a random `participant_id` and save `config.json` 3. Briefly explain to the user what this skill does:
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The framework instructs the skill to read raw observation and survey logs containing detailed behavioral data, verbatims, inferred needs, cost, and sensitive-work metadata. Although the broader skill metadata claims local storage and PII redaction, these instructions normalize broad access to highly sensitive per-session data without explicit minimization, access gating, or a handling warning at the point of use, which increases the risk of overcollection, unnecessary secondary use, and exposure of sensitive content in derived reports.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 88% confidence
- Finding
Creating a persistent paired record for every task consolidates observations, narratives, inferred needs, sentiments, cost data, and survey responses into a self-contained dossier of user behavior. This increases privacy risk by making re-identification, profiling, and long-term surveillance easier, especially when later steps explicitly support multi-day trend analysis and report generation across sessions.
- Content
md ## Step 2: Task-Level Pairing For each task observed, create a paired record: - The **observation** (what you saw: intent, approach, outcome, friction signals, sentiment, verbatims, cost, use case, inferred needs) - The **task context summary** (the narrative of what happened) - The **ethnographic analysis** (use case, workflow pattern, capabilities, effort/value, inferred needs)
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This code intentionally compiles sensitive observation data, free-text recollections, highlights/lowlights, and attachment references into a consolidated report intended for human consumption and possible sharing. Aggregation increases sensitivity because scattered data points become a comprehensive profile of behavior, sentiment, and potentially sensitive work, making accidental disclosure more damaging than any single source record.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The footer normalizes downstream sharing of the generated report by explicitly telling the user to email it, while the report and optional ZIP can contain detailed behavioral history, survey text, and case studies. Even though the script itself does not transmit data, encouraging sharing of a privacy-sensitive artifact without strong warnings, minimization, or consent checkpoints materially increases disclosure risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script writes a comprehensive report containing user observations, inferred needs, sentiment, friction details, and survey free text to a predictable location on disk with no sensitivity warning, retention limit, or access-hardening. In the context of continuous background observation, local persistence itself is a meaningful exposure surface because other local users, processes, backups, or later manual sharing can access a rich dossier of user activity.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This finding is also valid. The module comment says it includes PII redaction metadata, but the implementation performs detection only and may create a false sense of safety for operators or downstream components that assume logged content is already sanitized. In a privacy-sensitive telemetry skill, misleading security claims increase the likelihood that raw sensitive text will be collected, retained, or reused under incorrect assumptions.
- Content
Static analysis
No suspicious patterns detected.